CVE-2022-4230: WP Statistics SQLi Vulnerability

CVE-2022-4230 Overview

CVE-2022-4230 is an authenticated SQL injection vulnerability in the WP Statistics WordPress plugin before version 13.2.9. The plugin fails to escape a user-controlled parameter before incorporating it into a database query. Authenticated users can inject arbitrary SQL statements through the affected feature. By default, only users with the manage_options capability (administrators) can reach the vulnerable code path. However, the plugin exposes a setting that grants low-privilege users access to the same feature, broadening the attack surface significantly.

Critical Impact
Authenticated attackers can extract database contents, including user credentials and session tokens, leading to full WordPress site compromise.

Affected Products

Veronalabs WP Statistics plugin for WordPress
All versions prior to 13.2.9
WordPress installations where the plugin permits low-privilege users to access statistics

Discovery Timeline

2023-01-23 - CVE-2022-4230 published to the National Vulnerability Database
2025-04-02 - Last updated in NVD database

Technical Details for CVE-2022-4230

Vulnerability Analysis

The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. WP Statistics accepts a parameter from an authenticated HTTP request and concatenates it into a SQL query without escaping or parameterization. An attacker supplies SQL syntax in place of the expected value, altering the query semantics.

The affected functionality processes statistics data accessible through the WordPress administrative interface. Although the default capability requirement is manage_options, the plugin offers a configuration option that permits subscribers and other low-privilege roles to view statistics. Sites that enable this option expose the SQL injection sink to any authenticated user.

Successful exploitation allows extraction of wp_users password hashes, session cookies stored in wp_usermeta, and any sensitive content stored in the WordPress database. Attackers can chain the injection with credential cracking or session takeover to achieve administrator access. The Exploit Prediction Scoring System places this issue in the upper exploitation-likelihood range relative to other published CVEs.

Root Cause

The root cause is missing input sanitization on a request parameter before it is interpolated into a SQL statement. The plugin does not use $wpdb->prepare() or equivalent parameterized query construction for the affected code path.

Attack Vector

The vulnerability requires network access to the WordPress site and valid authenticated credentials. No user interaction is needed beyond the attacker submitting a crafted request to the vulnerable endpoint. On configurations that grant statistics access to low-privilege users, even subscriber-level accounts can trigger the injection. Technical details are documented in the WPScan Vulnerability Report.

// No verified public proof-of-concept code is available.
// Refer to the WPScan advisory for technical specifics.

Detection Methods for CVE-2022-4230

Indicators of Compromise

HTTP requests to WP Statistics endpoints containing SQL syntax such as UNION SELECT, SLEEP(, BENCHMARK(, or comment markers like -- and /*
Unexpected outbound database errors logged by WordPress or the underlying MySQL/MariaDB server
New or modified administrator accounts in wp_users that do not correspond to legitimate activity
Authenticated sessions from subscriber accounts accessing statistics features on sites that previously restricted them

Detection Strategies

Inspect WordPress access logs for requests to WP Statistics admin-ajax actions containing SQL keywords or encoded payloads
Enable MySQL general query logging temporarily and search for anomalous query structures originating from the WordPress process
Deploy a web application firewall rule that flags SQL metacharacters in WP Statistics parameters
Correlate authentication events with privileged data access using a SIEM

Monitoring Recommendations

Forward WordPress, web server, and database logs to a centralized analytics platform for retention and correlation
Alert on repeated failed query patterns or syntax errors that indicate injection probing
Monitor changes to wp_users and wp_options tables in near real time
Track plugin version inventory across WordPress fleets to identify unpatched installations

How to Mitigate CVE-2022-4230

Immediate Actions Required

Upgrade the WP Statistics plugin to version 13.2.9 or later on every WordPress instance
Audit the plugin's role configuration and revoke statistics access from subscriber and low-privilege roles
Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected
Review the database for unauthorized user accounts and modified options

Patch Information

Veronalabs addressed the vulnerability in WP Statistics version 13.2.9 by escaping the affected parameter. Administrators should update through the WordPress plugin manager or by deploying the fixed package via configuration management. See the WPScan Vulnerability Report for the disclosed remediation reference.

Workarounds

Disable the WP Statistics plugin until the patched version is deployed
Restrict access to the statistics feature so that only administrators with manage_options can view it
Place the WordPress administrative interface behind an IP allowlist or VPN to limit who can authenticate
Apply a web application firewall ruleset that blocks SQL injection patterns targeting WP Statistics endpoints

bash

# Update WP Statistics using WP-CLI
wp plugin update wp-statistics --version=13.2.9

# Verify installed version
wp plugin get wp-statistics --field=version